Add a Dependabot config

This PR introduces a Dependabot config, and deliberately downgrades the GitHub action versions to validate / demonstrate Dependabot PR submissions. If merged, you can expect Dependabot to nearly immediately submit an update PR for the `actions/checkout` and `actions/setup-python` actions.